Recovery Cafe data breach

Clerk's notes

Recovery Cafe, operating in Indiana, has formally reported a data security incident to state authorities. The filing indicates that an unauthorized disclosure of sensitive participant data occurred on or about June 26, 2026, with the official report submitted on August 6, 2026. The matter is presently designated as 'monitoring' in terms of its investigation status.

The disclosed information from this incident includes Full Name, Date of Birth, Social Security Number, Medical Record Number, Diagnosis and Treatment Information, Counseling and Progress Notes, Health Insurance ID Number, and Contact Information. These categories represent a significant scope of personal health and identification details.

Exposure of this nature carries various implications for affected individuals. It creates potential avenues for identity theft through the misuse of Social Security Numbers, facilitates medical fraud via compromised health insurance details or medical records, and could lead to targeted phishing attempts utilizing contact information and other sensitive personal data.

As a provider handling deeply personal health and wellness data, Recovery Cafe is responsible for implementing robust cyber security protocols. The occurrence of this data breach suggests that existing safeguards may have been insufficient to prevent unauthorized access to confidential records, which is a key component of their duty of care.

Individuals who have received a direct notification letter from Recovery Cafe regarding this data breach are confirmed to have had their personal information compromised. We provide free case reviews for those impacted to help them understand their legal position and potential next steps, without any obligation to proceed.

If a notification letter about this breach reached you, see every Indiana data breach on file or browse all cases.